Submitted URL: http://rpe.tfaleak.click/
Effective URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Submission: On December 18 via api from US — Scanned from IL

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 104.21.48.1, located in and belongs to CLOUDFLARENET, US. The main domain is dihaurefuidkuilopsee.life.
TLS certificate: Issued by WE1 on December 1st 2024. Valid for: 3 months.
This is the only time dihaurefuidkuilopsee.life was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 172.67.205.59 13335 (CLOUDFLAR...)
5 104.21.38.73 13335 (CLOUDFLAR...)
1 1 172.67.219.216 13335 (CLOUDFLAR...)
5 104.21.48.1 13335 (CLOUDFLAR...)
1 104.18.95.41 ()
16 5
Domain Requested by
5 dihaurefuidkuilopsee.life dihaurefuidkuilopsee.life
5 matomo.tfa1eak.click rpe.tfaleak.click
matomo.tfa1eak.click
2 rpe.tfaleak.click
1 challenges.cloudflare.com dihaurefuidkuilopsee.life
challenges.cloudflare.com
1 5z84.tfa1eak.click 1 redirects
16 5

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
tfaleak.click
WE1
2024-12-12 -
2025-03-12
3 months crt.sh
tfa1eak.click
WE1
2024-12-12 -
2025-03-12
3 months crt.sh
dihaurefuidkuilopsee.life
WE1
2024-12-01 -
2025-03-01
3 months crt.sh
challenges.cloudflare.com
WE1
2024-11-03 -
2025-02-01
3 months crt.sh

This page contains 2 frames:

Primary Page: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Frame ID: 00FBA64ABF4675D316197B94825B7462
Requests: 13 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/ndw2n/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/
Frame ID: ED985019A2B2BB257FC58C71E9396BA5
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

רק רגע...

Page URL History Show full URLs

  1. http://rpe.tfaleak.click/ HTTP 307
    https://rpe.tfaleak.click/ Page URL
  2. https://5z84.tfa1eak.click/leak-id-anVUQTE1bVhRVzJjQjVZU0VuTGpmVGF2dUk5MDNkYjFDQzlqczkzOS9Jd05sbzlSdFN5... HTTP 302
    https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • piwik\.js|piwik\.php

Page Statistics

16
Requests

81 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

112 kB
Transfer

248 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://rpe.tfaleak.click/ HTTP 307
    https://rpe.tfaleak.click/ Page URL
  2. https://5z84.tfa1eak.click/leak-id-anVUQTE1bVhRVzJjQjVZU0VuTGpmVGF2dUk5MDNkYjFDQzlqczkzOS9Jd05sbzlSdFN5NmVsendxU1lOTnc2Mg== HTTP 302
    https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://rpe.tfaleak.click/ HTTP 307
  • https://rpe.tfaleak.click/

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
rpe.tfaleak.click/
Redirect Chain
  • http://rpe.tfaleak.click/
  • https://rpe.tfaleak.click/
1 KB
1 KB
Document
General
Full URL
https://rpe.tfaleak.click/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.205.59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
537c766ccbda3aefef468ab43c85ee81bee162305e72adbbf9953e246b094ec9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f4053a5addf5e1d-MAD
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Wed, 18 Dec 2024 15:53:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xwdzTSrcT7vTHd27GRbMmjhPX6Pe%2FtZ2hy9okMDLciq24D1NILW2Kgj0%2Fz1oiYPbQLFJB%2FMJ9gqryjQegc5gAkiFA4F6K1phXCVkxCuERdVugx%2BWZHP9wqjWIhFSkONBqvF86Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=124376&min_rtt=123137&rtt_var=47061&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4109&recv_bytes=4351&delivery_rate=25336&cwnd=12000&unsent_bytes=0&cid=ffefa93639ada258&ts=223&x=1" cfExtPri cfHdrFlush;dur=0
vary
accept-encoding

Redirect headers

Location
https://rpe.tfaleak.click/
Non-Authoritative-Reason
HttpsUpgrades
piwik.js
matomo.tfa1eak.click/
64 KB
23 KB
Script
General
Full URL
https://matomo.tfa1eak.click/piwik.js
Requested by
Host: rpe.tfaleak.click
URL: https://rpe.tfaleak.click/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.38.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://rpe.tfaleak.click/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"64a9baf6-10132"
age
2444160
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=avVWJ0p9hb5F7NNUHZWNdm0Zjf0A6VKU3FSwKE3vYeKsWJBjfd4dji4BqwCwuZFgAEyq6IRdeAMn0AkAjpmlJIcuNtmQS2FMNetRwwJ0Qk4Q1iDOXLPM%2BGs2GCppwujqmCt%2FfsdapA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=121758&min_rtt=121754&rtt_var=45666&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4136&recv_bytes=4237&delivery_rate=27271&cwnd=12000&unsent_bytes=0&cid=4f4524806a8fc141&ts=165&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:37 GMT
content-type
application/javascript
last-modified
Sat, 08 Jul 2023 19:37:26 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f4053aa2a494c43-MXP
server
cloudflare
piwik.php
matomo.tfa1eak.click/
0
655 B
Ping
General
Full URL
https://matomo.tfa1eak.click/piwik.php?action_name=&idsite=975&rec=1&r=349119&h=17&m=53&s=37&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=7fa90bc59aaab085&_idn=1&send_image=0&_refts=1734537218&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=OoVmCH&pf_net=148&pf_srv=204&pf_tfr=2&pf_dm1=348&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by
Host: matomo.tfa1eak.click
URL: https://matomo.tfa1eak.click/piwik.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.38.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8
Referer
https://rpe.tfaleak.click/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dMFqGOaLYFO%2FaupEYz3l24Li5ss2wQwjEx%2BPWkymUUuUy2QCaxsXzfDZyg9jE3qJLAuU9po839FYmgVVROpY5KD9YTbC8u%2F6iVwm1UBUt%2Fe5OMCO8fJjtzkV0XX7CFwQaYX98Bw8OQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
8f4053ad2cec4c43-MXP
access-control-allow-origin
https://rpe.tfaleak.click
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=143464&min_rtt=121754&rtt_var=10523&sent=35&recv=22&lost=0&retrans=0&sent_bytes=28293&recv_bytes=6221&delivery_rate=98170&cwnd=21300&unsent_bytes=0&cid=4f4524806a8fc141&ts=753&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:38 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
priority
u=4,i
piwik.php
matomo.tfa1eak.click/
0
656 B
Ping
General
Full URL
https://matomo.tfa1eak.click/piwik.php?action_name=&idsite=1&rec=1&r=522857&h=17&m=53&s=37&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=336c65ae03b46b6d&_idn=1&send_image=0&_refts=1734537218&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=ZnkBmw&pf_net=148&pf_srv=204&pf_tfr=2&pf_dm1=348&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by
Host: matomo.tfa1eak.click
URL: https://matomo.tfa1eak.click/piwik.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.38.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8
Referer
https://rpe.tfaleak.click/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gAuwgeOrWLp2oRzfgu0wLIMx5NXj11enyY3rnmLRH6%2F5zF3Cm4Jf36yBXvLGe%2F2TRGk%2F6n2UisyyBJMp%2BEVQkj8oS2f5k1Oh7WJHxY5%2By03O8joIU3VxUvFZjEouGSu3u90NWJyM2A%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
8f4053ad2cee4c43-MXP
access-control-allow-origin
https://rpe.tfaleak.click
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=143464&min_rtt=121754&rtt_var=10523&sent=36&recv=22&lost=0&retrans=0&sent_bytes=28971&recv_bytes=6221&delivery_rate=98170&cwnd=21300&unsent_bytes=0&cid=4f4524806a8fc141&ts=753&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:38 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
priority
u=4,i
favicon.ico
rpe.tfaleak.click/
571 B
826 B
Other
General
Full URL
https://rpe.tfaleak.click/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.205.59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d50b9852ce176350c41f3a8b9bc01132659f8b18b9ccec1cdea6e98d28176daf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://rpe.tfaleak.click/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nnYzDZyf6e2TO1UUhEMeYiJGrfPVtrAdnT1Yj1w043VhReUkpvnSit85%2FcOAmU5byewF1Arw%2BtaFQ4uON4%2BD3eD9Vsu85MJFMeFbIGzgeZos28Luym2Lc6AMp9xjQF6B%2BPj3Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f4053ad3c3a5e1d-MAD
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=134437&min_rtt=123137&rtt_var=30089&sent=14&recv=12&lost=0&retrans=0&sent_bytes=5542&recv_bytes=5100&delivery_rate=8769&cwnd=12000&unsent_bytes=0&cid=ffefa93639ada258&ts=1433&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:38 GMT
content-type
text/html
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
piwik.php
matomo.tfa1eak.click/
0
657 B
Ping
General
Full URL
https://matomo.tfa1eak.click/piwik.php?idgoal=1&idsite=975&rec=1&r=880536&h=17&m=53&s=38&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=7fa90bc59aaab085&_idn=0&send_image=0&_refts=1734537218&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=OoVmCH&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by
Host: matomo.tfa1eak.click
URL: https://matomo.tfa1eak.click/piwik.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.38.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8
Referer
https://rpe.tfaleak.click/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JkzuasdH8WQCHI4Z5qIgdPTfGwIn4ps4ONnDqHjUqJPCpX7a1%2B2L1UbyruKLsiXo0vVADIfBFty5s2vpTH5hbNOMP9TlS%2F5q%2Fgm835cbD6DjMjQ77aXLDK%2Br%2F%2FHO65bYDCEYSe2HgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
8f4053b1f9e44c43-MXP
access-control-allow-origin
https://rpe.tfaleak.click
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=140805&min_rtt=121754&rtt_var=13211&sent=39&recv=25&lost=0&retrans=0&sent_bytes=30765&recv_bytes=7619&delivery_rate=5511&cwnd=21300&unsent_bytes=0&cid=4f4524806a8fc141&ts=1477&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:38 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
priority
u=4,i
piwik.php
matomo.tfa1eak.click/
410 B
1 KB
Ping
General
Full URL
https://matomo.tfa1eak.click/piwik.php?idgoal=1&idsite=1&rec=1&r=968826&h=17&m=53&s=38&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=336c65ae03b46b6d&_idn=0&send_image=0&_refts=1734537218&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=ZnkBmw&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by
Host: matomo.tfa1eak.click
URL: https://matomo.tfa1eak.click/piwik.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.38.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8
Referer
https://rpe.tfaleak.click/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EaqVBHSywD6RwMQMYkwSxnpbRWWud5l%2BlEAkvtKMYsltXG%2Fp%2BQIUsHHdcxe0IlkzTcOp8NpPzz9nN0pahOMjolRBTy1uEvssQjwMTURtiKdnD%2Bb9xC1PNZAyfwpcigp4yuOogOFOtg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
8f4053b1f9e54c43-MXP
access-control-allow-origin
https://rpe.tfaleak.click
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=140805&min_rtt=121754&rtt_var=13211&sent=38&recv=25&lost=0&retrans=0&sent_bytes=29673&recv_bytes=7619&delivery_rate=5511&cwnd=21300&unsent_bytes=0&cid=4f4524806a8fc141&ts=1466&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 18 Dec 2024 15:53:38 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
priority
u=4,i
Primary Request /
dihaurefuidkuilopsee.life/
Redirect Chain
  • https://5z84.tfa1eak.click/leak-id-anVUQTE1bVhRVzJjQjVZU0VuTGpmVGF2dUk5MDNkYjFDQzlqczkzOS9Jd05sbzlSdFN5NmVsendxU1lOTnc2Mg==
  • https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
9 KB
8 KB
Document
General
Full URL
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.48.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47b4a2e00831dec1fa418dad61d84f59b1dcade8c7b954a6654ffbbd88bdcd2c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://rpe.tfaleak.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out
YrmnZmHzmcvSTbNelu2QSuQVZbcSpQJUh4XQrlk1agUiq+ATazLOJw0s/53Nm8DuxyOBu3jIlPHtHRXsSla/Ty2FbmpAtje+KbYtEcnDCzfEOQ94hH/hdcKi6yI0RZlSrtPCvxCdLMpoG2pym0UFgg==$nReSsqsHje9WrvynsWM/mA==
cf-mitigated
challenge
cf-ray
8f4053b7cc1fc233-TLV
content-encoding
zstd
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Wed, 18 Dec 2024 15:53:39 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0lX8o%2B9iW%2Bu%2Fr8KPsvTu6xuQzv%2B3Zu1zESzSwO48CBS%2Fg4Fr%2BHTc831ED2ghV4ZYviEstkkarzEQYPlEIwgv68f7dQKwDiZV1UJT4wZLlg8WlaEF8YQ34MvzSZ2xCZKAHNOxej2rb6HmF0UU"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-options
nosniff
x-frame-options
SAMEORIGIN

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f4053b4ccd53a6a-FRA
content-type
text/html; charset=UTF-8
date
Wed, 18 Dec 2024 15:53:39 GMT
location
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hLkQ1HiTk7jBH2woo%2FrQrJQGdF%2FnT3fIyBYBeBQhQzQWrJIBZSJgkr0NbVc6ClkC%2FOYQzi2lSur9M5H73MjjHfNz%2FTDzrOZlrL%2Bu0iiRozfbCiEuF7yhM3nzvJHOc1LQ7xaiJfw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=128455&min_rtt=128110&rtt_var=48731&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4137&recv_bytes=4442&delivery_rate=25926&cwnd=12000&unsent_bytes=0&cid=44baee4cc580aafe&ts=251&x=1" cfExtPri cfHdrFlush;dur=0
v1
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/
98 KB
38 KB
Script
General
Full URL
https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f4053b7cc1fc233
Requested by
Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.48.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5dd5334b1b4b274a69e4a09aae243c6fb5bb95bd8c4e525dad5cd930fcffe0f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975&__cf_chl_rt_tk=kS2zmfrtXxEME1zhbbmOKMHxRePQqG9hn1xNrrGE.1o-1734537219-1.0.1.1-aMzw1os_j6I_.p96h5zimHbxAjyovPlT0m7FLNHXF4U

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4F2bdKMHGuABoPuHMPlDBOqLX2zNHh9%2FWnTNfzdamFFsRxiIVv%2Buqry8QhGK1CvcQ%2F%2B%2Ffjm0l1aJTdUaduyByjY5xHougWY1EUq6rR5diZnLQvTuGF23DnnQLxM4xMgkJ4uE3GZQcuXuR1nC"}],"group":"cf-nel","max_age":604800}
cf-ray
8f4053b98c24c233-TLV
alt-svc
h3=":443"; ma=86400
date
Wed, 18 Dec 2024 15:53:40 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
api.js
challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/
47 KB
16 KB
Script
General
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit
Requested by
Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f4053b7cc1fc233
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.95.41 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
5aac9e52f80011983676c03ad8120e0369e651e6357d0b05054026a3bc8ec32d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://dihaurefuidkuilopsee.life
Referer

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
8f4053beba207da0-TLV
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Wed, 18 Dec 2024 15:53:40 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 10 Dec 2024 17:31:41 GMT
server
cloudflare
vary
Accept-Encoding
favicon.ico
dihaurefuidkuilopsee.life/
7 KB
7 KB
Image
General
Full URL
https://dihaurefuidkuilopsee.life/favicon.ico
Requested by
Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.48.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cca955f04eca2df9e23d0edc3bd102ce4110cb5bdcde72acca48a74388039546
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975

Response headers

content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=soUka4yWwvW454WbzHucUIZguBH1IrVkZy9HyB48sKQIGqcPl0IgniW5AcO9nrcRjoGXnKsf4IKPVc1SxDQr4D0YAaCIB%2FqrRoBi4Fyqn6cyOfB6e57QiNqjNff38i10cniFN2uUwjoK0f4i"}],"group":"cf-nel","max_age":604800}
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires
Thu, 01 Jan 1970 00:00:01 GMT
alt-svc
h3=":443"; ma=86400
x-content-options
nosniff
date
Wed, 18 Dec 2024 15:53:40 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
cf-chl-out
p0xWYB+NKaVTbFUVk27d8v844RaEii7W8A+Gz+ME7AjFvoQDnVWv9t4IQCuNc651w5eoKvqBTcQjdO0teIX47tbFwuuJRQoNhC4IBbAKrZjbeCZo9rK/1Xj/QcmVWAquFgIZvV6ikfV5ValDxROq2Q==$zH208K9ySWtN161FPwSqZQ==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
8f4053bc3c2bc233-TLV
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster
?1
server
cloudflare
eec6fcf2-990a-47a8-a89e-1b1c8ae76d3e
https://dihaurefuidkuilopsee.life/ Frame
0
0

6TgW5FLuM7iTjrjtpMyTZUgrcL7Z4sYaUcKdQYrXroA-1734537219-1.2.1.1-T9R8gQE0dHa8yw85qmgQmg1ofTguVfc524GlnMsdGlhU3qjem0B6TuYsyDU78xVd
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/1644423434:1734534778:_D1-YzTzs8UuGG0RzXaNySe2TlQnMGDTNcWXaqCsw5E/8f4053b7cc1fc233/
13 KB
9 KB
XHR
General
Full URL
https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/1644423434:1734534778:_D1-YzTzs8UuGG0RzXaNySe2TlQnMGDTNcWXaqCsw5E/8f4053b7cc1fc233/6TgW5FLuM7iTjrjtpMyTZUgrcL7Z4sYaUcKdQYrXroA-1734537219-1.2.1.1-T9R8gQE0dHa8yw85qmgQmg1ofTguVfc524GlnMsdGlhU3qjem0B6TuYsyDU78xVd
Requested by
Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f4053b7cc1fc233
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.48.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f98acf44801cd6e086046be3a9f404aa47750b4ccb30287e2f7dffddde2a7c97

Request headers

Referer
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
CF-Chl-RetryAttempt
0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded
CF-Challenge
6TgW5FLuM7iTjrjtpMyTZUgrcL7Z4sYaUcKdQYrXroA-1734537219-1.2.1.1-T9R8gQE0dHa8yw85qmgQmg1ofTguVfc524GlnMsdGlhU3qjem0B6TuYsyDU78xVd

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IpIevRp2y7jtb%2F6NZ3YWXhwaqtBAV6pYWw1eAgwA%2FwhtvHumxmuy01ryfkSfGvC7ErSmkWVWV0bes6Fow6vWa2npcArkwRkTAN2qN8mbqZY21k3XyC%2F%2FmjCqSI6g6tml0F69liu33piO%2FV%2Fe"}],"group":"cf-nel","max_age":604800}
cf-ray
8f4053bd1c2dc233-TLV
alt-svc
h3=":443"; ma=86400
date
Wed, 18 Dec 2024 15:53:40 GMT
content-type
text/plain; charset=UTF-8
cf-chl-gen
RUFEYCvS3dwMGVBFXafeRZih2h1nek35zA+0InnOK9fomGJ+OeJI6GY1dzVVKC4FEtptFUGZ+NA=$UNfje0iBs7axKqnL
server
cloudflare
87271515-1fbd-4524-b368-9bbbaa6e1db9
https://dihaurefuidkuilopsee.life/ Frame
0
0

/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/ndw2n/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/ Frame ED98
0
0

favicon.ico
dihaurefuidkuilopsee.life/
7 KB
6 KB
Other
General
Full URL
https://dihaurefuidkuilopsee.life/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.48.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e89046cb1d2cba88e1a41fba28ace0fe0346699f06565aba9aea6cf6a0af4d9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975

Response headers

content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FRbA7vOcYaXVZiF02m6m7kHg%2F1iZx9w3m7GL3pRdrB8kJhvdywA8sfZiwycfcY7Yy7as%2F6WOIIZspsU9%2BQJhaDCxMs5sDJc3%2FaD%2FteLgdauO3rIoWWw6DWIIARTIzP7ouSZ%2BrVfRM6%2ByLto0"}],"group":"cf-nel","max_age":604800}
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires
Thu, 01 Jan 1970 00:00:01 GMT
alt-svc
h3=":443"; ma=86400
x-content-options
nosniff
date
Wed, 18 Dec 2024 15:53:41 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
cf-chl-out
1iMtjErfO/PACU2MygS7OXDFx9fOtygerFktNNOoLu6Xu0aiCgpdCS12LqY8XLpx8WjtA0x5JOsL791rkVB4o4q4sdSyRbU8yzVOK6/sL9AzPgsN8eDX0N/sGQu8kUwXoADD4e3+UZ/Phgcy0umm0A==$W75Oo3QCMfYzs9gd0kQNpg==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
8f4053c13c48c233-TLV
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster
?1
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dihaurefuidkuilopsee.life
URL
blob:https://dihaurefuidkuilopsee.life/eec6fcf2-990a-47a8-a89e-1b1c8ae76d3e
Domain
dihaurefuidkuilopsee.life
URL
blob:https://dihaurefuidkuilopsee.life/87271515-1fbd-4524-b368-9bbbaa6e1db9
Domain
challenges.cloudflare.com
URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/ndw2n/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _cf_chl_opt function| GVOAr6 function| YHws6 function| Whin0 function| domE8 object| hephn8 object| bOVG4 function| CScbg6 function| omQod3 function| WXqDk4 function| PmhRk7 object| cVGi2 number| VaUI1 object| angular object| qHqZf6 function| _ string| wpvie3 object| turnstile boolean| aRcx2 boolean| nSSnK5

6 Cookies

Domain/Path Name / Value
rpe.tfaleak.click/ Name: _pk_ref.975.26c9
Value: %5B%22%22%2C%22%22%2C1734537218%2C%22https%3A%2F%2Ftelegra.ph%2F-%22%5D
rpe.tfaleak.click/ Name: _pk_id.975.26c9
Value: 7fa90bc59aaab085.1734537218.
rpe.tfaleak.click/ Name: _pk_ses.975.26c9
Value: 1
rpe.tfaleak.click/ Name: _pk_ref.1.26c9
Value: %5B%22%22%2C%22%22%2C1734537218%2C%22https%3A%2F%2Ftelegra.ph%2F-%22%5D
rpe.tfaleak.click/ Name: _pk_id.1.26c9
Value: 336c65ae03b46b6d.1734537218.
rpe.tfaleak.click/ Name: _pk_ses.1.26c9
Value: 1

5 Console Messages

Source Level URL
Text
network error URL: https://rpe.tfaleak.click/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://matomo.tfa1eak.click/piwik.php?idgoal=1&idsite=1&rec=1&r=968826&h=17&m=53&s=38&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=336c65ae03b46b6d&_idn=0&send_image=0&_refts=1734537218&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=ZnkBmw&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=975
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://dihaurefuidkuilopsee.life/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://dihaurefuidkuilopsee.life/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()